--- head.orig/drivers/xen/netfront/netfront.c	2013-05-10 14:43:24.000000000 +0200
+++ head/drivers/xen/netfront/netfront.c	2013-07-05 10:56:41.000000000 +0200
@@ -1309,6 +1309,15 @@ static RING_IDX xennet_fill_frags(struct
 		struct netif_rx_response *rx =
 			RING_GET_RESPONSE(&np->rx, ++cons);
 
+		if (nr_frags == MAX_SKB_FRAGS) {
+			unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
+
+			BUG_ON(pull_to <= skb_headlen(skb));
+			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+			nr_frags = shinfo->nr_frags;
+		}
+		BUG_ON(nr_frags >= MAX_SKB_FRAGS);
+
 		__skb_fill_page_desc(skb, nr_frags,
 				     skb_frag_page(skb_shinfo(nskb)->frags),
 				     rx->offset, rx->status);
@@ -1480,7 +1489,8 @@ err:	
 	while ((skb = __skb_dequeue(&rxq)) != NULL) {
 		unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
 
-		__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+		if (pull_to > skb_headlen(skb))
+			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
 
 		/* Ethernet work: Delayed to here as it peeks the header. */
 		skb->protocol = eth_type_trans(skb, dev);